Former FTC technologist to lead California’s new privacy regulator

A new data-privacy agency created last year by a California ballot referendum will be led by Ashkan Soltani, a former chief technologist at the Federal Trade Commission, officials announced Monday.

Soltani was named as executive director of the California Privacy Protection Agency, which was formed after the state’s voters approved Proposition 24, which aimed to refine and enforce the 2018 California Consumer Privacy Act, the landmark legislation that set broad rules about how companies collect and use internet users’ personal data.

Proposition 24, also known as the California Privacy Rights Act, builds upon the CCPA by giving consumers greater ability to prevent companies — including major tech firms like Facebook and Alphabet, as well as smaller retailers — from collecting or selling their sensitive personal information. The referendum also set more stringent rules for the collection of data from internet users under the age of 16.

Ashkan Soltani (Chip Somodevilla / Getty Images)

Soltani served as the FTC’s top technologist from 2014 to 2015 and also served a brief stint as a senior adviser to former Federal Chief Technology Officer Megan Smith during the final year of the Obama administration. Since then, he’s worked as an independent researcher and privacy advocate, contributing to the creation of both the CCPA and Proposition 24.

Before working in government, Soltani was an investigative journalist with the Washington Post, contributing to the paper’s Pulitzer Prize-winning coverage of the National Security Agency’s global surveillance programs involving major phone carriers and internet firms.

“We are thrilled to have Ashkan join the California Privacy Protection Agency,” Jennifer Urban, a University of California, Berkeley law professor who leads the agency’s five-member governing board, said in a press release. “His background in technology and privacy, and his work on both the CCPA and the CPRA give him a thorough understanding of California privacy law and will stand him in good stead as he leads agency staff and helps the agency fulfill its privacy protection mandate.”

While Proposition 24 passed with 55% support last year, it was not embraced as widely by the privacy-rights community as the CCPA was, with some of the organizations that backed the 2018 law — including the American Civil Liberties Union — opposing it. Detractors said the new law created an “opt-out” environment for consumers regarding data collection, rather than an “opt-in.” It also allows companies to charge customers who do not consent to data collection more for their services, a provision that made it possible for retailers to continue offering loyalty rewards programs.

Proposition 24 is scheduled to go into effect in 2023, at which point the new agency will split enforcement duties with the Office of the Attorney General, which will retain the power to bring civil lawsuits on behalf of the state’s residents.